Event 4502 Log analytics customs logs not present. Unable to get blob container for CustomLog

If you get this event in your opsmgr logs.

A module of type "Microsoft.EnterpriseManagement.Mom.Modules.CloudFileUpload.CloudFileUploadWriteAction" reported an exception Microsoft.EnterpriseManagement.Mom.Modules.CloudFileUpload.FileUploadException: Unable to get blob container for CustomLog from https://omsworkspaceid.ods.opinsights.azure.com/ContainerService.svc. Will keep trying according to the specified policy. ---> System.Net.WebException: The remote name could not be resolved: 'omsworkspaceid.ods.opinsights.azure.com'
   at System.Net.HttpWebRequest.EndGetRequestStream(IAsyncResult asyncResult, TransportContext& context)
   at System.Net.HttpWebRequest.EndGetRequestStream(IAsyncResult asyncResult)
   at Microsoft.EnterpriseManagement.Mom.Modules.CloudFileUpload.CloudFileUploadWriteAction.GetRequestStreamCallback(IAsyncResult asynchronousResult)
   --- End of inner exception stack trace --- which was running as part of rule "Microsoft.IntelligencePacks.CustomLogUpload.UploadCustomLog" running for instance

Just make sure that you are able to infact connect to that url from your servers.
If you rule out any firewall issues and the url infact does not exist which was in my case.
Since I am running this in the Azure government cloud the url for me was different.
This url can be found out by opening the overrides pane in your scom console.
Scope it to "Health Service" and look in Management pack object rule- Target Object.
The parameter Endpoint url is an overridedable parameter. Get the right one from the overrides in the others
the values for these endpoints vary according to the services that they provide. Just pick the right one which shows up in your event.
OperationalData.svc/PostDataItems
/ContainerService.svc/PostDataItems
/EtwEventCollectionDataService.svc/PostDataItems

 Then open rules and again scope them to health service.Find your rule from the event. Check the highlighted last line  from above event.
Override this rule and add the EndpointUrl that pertains to your environment.

Adding license to SCOM

System center licensing guide:

http://download.microsoft.com/download/8/9/A/89A3F8B9-94DE-4956-A56E-F6D2B215D0E6/SystemCenter2012R2_Licensing_Guide.pdf

License check commands:

Get-SCOMManagementGroup | ft skuforlicense, version, timeofexpiration –a

Set-SCOMLicense -ProductId "Enter your license key"

Microsoft Azure mp configuration for Azure Government cloud

The Microsoft Azure Management pack for SCOM 2012 R2 requires a little different configuration than the commercial cloud. I am going to write down some of the configurations that have to be done.

Link to download the mp:

https://www.microsoft.com/en-us/download/details.aspx?id=50013

Install the management pack and import the mp’s in your scom environment. 

The management pack documentation does a fairly good job in explaining the configuration. If you have an user who has read permissions to your Azure active directory and subscription then you can add your Azure subscription using the credentials for the user. But if you have an environment where dual authentication is “enforced” you can use the steps given below. Because apps may not be able receive calls or enter the code in the messages :D

Login to the new portal using your credentials. https://portal.azure.us/

Creating the App for login:

Click Azure Active Directory–App Registrations

Click Add in the top pane and fill up the following parameters for your app.

Name: AnyName [Make a note of this name.]

Application Type: Web App/API

Sign-on URL: http://anyurl  This url does not have to be a working url.

Then click create.

Now select your app under App Registration and in the next blade that opens select Keys.

There is no add button here. If you enter a description for your key then the next values are populated.

Select the expiry duration. As of now the values are 1 year,2 years and Never expires.

Once you hit save then the key value will be displayed.

Important Note:

This will be shown only once so make sure that you copy this key value somewhere safe.

If you have exited then go back to Active directory–App registrations select your app and copy the Application ID from the portal.

Click Active Directory–Domain Names and copy the Name of your domain if you don’t already know it.

These three values App id,domain name,Key will be required when you add your subscription in SCOM.

Now in the portal click on subscriptions. 

Select the subscription you wish to monitor.

Click Access Control in the next blade.

Click Add,select role Reader,Click add users if not already populated. 

In the search under Add users your app would not show up as it shows only users.

Enter the name of your app and click select.Click ok and your app should have reader permissions on your subscription.

Next open the SCOM Operations Console and create a new resource pool in Administration– -Resource Pools called “Azure monitoring resource pool”. 

Add the server that you want to be a member of this pool.

This is recommended because the operations are very resource intensive and if you have a dedicated management server for this pool you will not load the management group.

Navigate to Administration-Microsoft Azure.

Click Add subscription and click the radio button for Service Principal Name.

Remember the three values that i had asked your to copy. You will need them here.

Enter your domain name

Enter the Application ID in the Client ID field.

Enter the key in the password.

Click the advanced box and enter the following values. The forward slash “/” is also required in the ARM Management URI.

Management Service URI: https://management.core.windows.net

Storage Service DNS Suffix: core.usgovcloudapi.net

ARM Management URI: https://management.usgovcloudapi.net/

Your subscription should be populated in the next screen. Select the Azure monitoring server pool.

Next is self explanatory.

After this is done you should be able to see the subscription in

Monitoring–Microsoft Azure–Subscription State.

Now click Authoring and select Microsoft Azure Monitoring Template to configure the resources that you want to monitor.

More about that next time….

How to create a SCOM discovery override using powershell

This is script that can be used to create a scom discovery override using powershell.


## Usage:
## Check the overridable paramters for your discoveries first and then change the parameter you would like to set in $override.Parameter. The format of the parameter may be like
## Selector          : $Config/PeriodInSeconds$. You should only add the "PeriodInSeconds" part
#$disc = Get-SCOMDiscovery -DisplayName "Windows Internet Information Services Web Applications 76-100 Discovery Rule"
## $discovery.GetOverrideableParameters()


Import-module operationsmanager
New-SCOMManagementGroupConnection -ComputerName MyRMS
$mps = Get-SCOMManagementPack |?{$_.name -match "Microsoft.Windows.InternetInformationServices.2003"}
$overridemp = Get-SCOMManagementPack -Name "IIS.Management.Pack.Discovery.Overrides"
$discoveries = Get-SCOMDiscovery -ManagementPack $mps

foreach($discovery in $discoveries)
{
if($discovery.Enabled -ne "false")
{

$override = $null
$overridemp = Get-SCOMManagementPack -Name "IIS.Management.Pack.Discovery.Overrides"
$Target= Get-SCOMClass -id $discovery.Target.Id

$overridename = $discovery.name + ".Override"
$override = New-Object Microsoft.EnterpriseManagement.Configuration.ManagementPackDiscoveryConfigurationOverride($overridemp,$overridename)
$override.Discovery = $discovery
$override.Module = $discovery.DataSource
$override.Parameter = "PeriodInSeconds"
$override.value = 86400
$override.DisplayName = $overridename
$override.Context = $Target

}
}

$overridemp.Verify() ## This may fail sometimes with a validation error on 2012 R2. So just remove this line and check if your mp imports.
$overridemp.AcceptChanges()

Manually run partitioning and grooming on SCOM database

The following query if run on the SCOM db will run the grooming on all the partition tables. There are 122 partition tables in SCOM 2012. This will run for each one of them as their Iscurrent value is set to 1.

/*-------------------------------*/

declare @counter int  set @counter = 0  while @counter < 122

begin

exec p_PartitioningAndGrooming

set @counter = @counter + 1

print 'The counter is ' + cast(@counter as char)

end

/*-----------------------------*/